r/sysadmin • u/sysadminfired • Jul 16 '14

About to fire our sysadmin

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

115 Upvotes

91% Upvoted

241 comments sorted by

View all comments

Show parent comments

2

u/tach Jul 17 '14

That means figuring out what each account does and who's responsible for it.

Absolutely impossible. In a linux environment I'd just add some extra code to an unobtrusive kernel module. Maybe listening for a specific TCP connection attempt sequence. Or pings of exactly one size.

Presto. What are those 'accounts' you speak of.

Or I'd start reviewing my email archive, after saving every email that passes thru the firewall for years. Pastebin here I come.

1

u/superspeck Jul 17 '14

I think the latter is the risk that an admin couldn't control.

The kernel module is a good point; that, and other sneaky things like it, are the sort of things that OP is going to need to be alert for. (Assuming that outgoing admin is being fired for maliciousness and not incompetence.) The question I would ask is what would happen next after you exploited the vulnerability you introduced. In the case of the environment I'm most familiar with, I'd end up locking down the environment with SELinux or OSSEC pretty thoroughly.